# Update detection rules from elastic github repository to on-premises

**URL:** <https://discuss.elastic.co/t/update-detection-rules-from-elastic-github-repository-to-on-premises/242211>\
**Category:** SIEM\
**Created:** [July 22, 2020, 2:29pm UTC](https://discuss.elastic.co/t/update-detection-rules-from-elastic-github-repository-to-on-premises/242211 "2020-07-22T14:29:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [July 22, 2020, 2:29pm UTC](https://discuss.elastic.co/t/update-detection-rules-from-elastic-github-repository-to-on-premises/242211/1 "2020-07-22T14:29:44Z")

</div>

Hi there,

I would like to know if is possible to update existing rules from elastic detection rules repository to kibana on-premises?

For example: CVE-2020-1350 which has been released by the elastic security team.

Thanks for the attention.

---

<div class="post-metadata">

**Author:** ![devonkerr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devonkerr/32/56711_2.png) [@devonkerr](https://discuss.elastic.co/u/devonkerr)\
**Post date:** [August 4, 2020, 3:55pm UTC](https://discuss.elastic.co/t/update-detection-rules-from-elastic-github-repository-to-on-premises/242211/2 "2020-08-04T15:55:36Z")

</div>

@francescouk, we're considering options for this feature but don't have an automated solution today. Clarifying a little, you'd be interested in a feature that polls a github repository and automatically updates any rules with the same ID that may have changed?

---

<div class="post-metadata">

**Author:** ![francescouk](https://avatars.discourse-cdn.com/v4/letter/f/7feea3/32.png) [@francescouk](https://discuss.elastic.co/u/francescouk)\
**Post date:** [August 4, 2020, 4:19pm UTC](https://discuss.elastic.co/t/update-detection-rules-from-elastic-github-repository-to-on-premises/242211/3 "2020-08-04T16:19:19Z")

</div>

Yes, also all the rules that have been added. This would make sure that all rules always been updated.

If not, maybe a tool to convert the toml to ndjson also would help.

Best regards,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2020, 4:19pm UTC](https://discuss.elastic.co/t/update-detection-rules-from-elastic-github-repository-to-on-premises/242211/4 "2020-09-01T16:19:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.